composer
Vulnerability activity for composer: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 7
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 2.5LowOct 29, 2026composer pocketmine/pocketmine-mpISSUE-GHSApg53p7qp65cv### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to repeatedly execute pre-spawn progression. ### Impact Multiple `Player` objects can be created for just a single session, increasing memory usage and amplifying outbound network traffic from duplication of large p
- 4.2MediumOct 29, 2026composer silverstripe/mfa Auth bypass / access controlCVE-2026-55186### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected.
- 8.0HighOct 27, 2026composer symfony/symfony Denial of serviceCVE-2026-109413### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `maxNestingLevel`. A document made of deeply nested inline collections, such as `[[[[...]]]]`, exhausted the stack while it was being lexed: depending on the PHP version and its stack settings, the process crashed or the request ended with a fatal error. Any c
- 8.8HighOct 27, 2026composer dolibarr/dolibarr SQL injectionCVE-2026-33944### Summary A SQL Injection vulnerability exists in the Third Party (Company) update functionality of Dolibarr ERP/CRM. The `localtax1_value` parameter (`lt1`) is concatenated directly into an SQL UPDATE statement in `societe/class/societe.class.php` at line 1672 without any escaping, type casting, or parameterized query binding. An authenticated user with standard "Third Party: Create/Edit" permission can extract any data from the database, including password hashes, API keys, and all
- 9.5CriticalOct 23, 2026composer laravel/framework Auth bypass / access controlCVE-2026-114509Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. **Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected. ### Im
- 6.5MediumOct 23, 2026composer laravel/frameworkCVE-2026-114508Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity. This issue is fixed in versions 12.68.0 and 13.27.0.
- 6.5MediumOct 23, 2026composer livewire/livewire Auth bypass / access controlISSUE-GHSAmhf7xp6r6qrc### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for: 1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{"1": 2, "0": 1}`) could pass authorization with a record the user owns while the action received a different recor
Top products
- laravel/framework2 CVEs in the last year, 1 critical
- symfony/symfony1 CVE in the last year
- silverstripe/mfa1 CVE in the last year
- pocketmine/pocketmine-mp1 CVE in the last year
- livewire/livewire1 CVE in the last year
- dolibarr/dolibarr1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.